CHANGES revision 1.1
1 Thu. April 1, 2010. guy (a] alum.mit.edu. 2 Summary for 4.1.1 tcpdump release 3 Fix build on systems with PF, such as FreeBSD and OpenBSD. 4 Don't blow up if a zero-length link-layer address is passed to 5 linkaddr_string(). 6 7 Thu. March 11, 2010. ken (a] netfunctional.ca/guy (a] alum.mit.edu. 8 Summary for 4.1.0 tcpdump release 9 Fix printing of MAC addresses for VLAN frames with a length 10 field 11 Add some additional bounds checks and use the EXTRACT_ macros 12 more 13 Add a -b flag to print the AS number in BGP packets in ASDOT 14 notation rather than ASPLAIN notation 15 Add ICMPv6 RFC 5006 support 16 Decode the access flags in NFS access requests 17 Handle the new DLT_ for memory-mapped USB captures on Linux 18 Make the default snapshot (-s) the maximum 19 Print name of device (when -L is used) 20 Support for OpenSolaris (and SXCE build 125 and later) 21 Print new TCP flags 22 Add support for RPL DIO 23 Add support for TCP User Timeout (UTO) 24 Add support for non-standard Ethertypes used by 3com PPPoE gear 25 Add support for 802.11n and 802.11s 26 Add support for Transparent Ethernet Bridge ethertype in GRE 27 Add 4 byte AS support for BGP printer 28 Add support for the MDT SAFI 66 BG printer 29 Add basic IPv6 support to print-olsr 30 Add USB printer 31 Add printer for ForCES 32 Handle frames with an FCS 33 Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames 34 Fix TCP sequence number printing 35 Report 802.2 packets as 802.2 instead of 802.3 36 Don't include -L/usr/lib in LDFLAGS 37 On x86_64 Linux, look in lib64 directory too 38 Lots of code clean ups 39 Autoconf clean ups 40 Update testcases to make output changes 41 Fix compiling with/out smi (--with{,out}-smi) 42 Fix compiling without IPv6 support (--disable-ipv6) 43 44 Mon. October 27, 2008. ken (a] netfunctional.ca. Summary for 4.0.0 tcpdump release 45 Add support for Bluetooth Sniffing 46 Add support for Realtek Remote Control Protocol (openrrcp.org.ru) 47 Add support for 802.11 AVS 48 Add support for SMB over TCP 49 Add support for 4 byte BGP AS printing 50 Add support for compiling on case-insensitive file systems 51 Add support for ikev2 printing 52 Update support for decoding AFS 53 Update DHCPv6 printer 54 Use newer libpcap API's (allows -B option on all platforms) 55 Add -I to turn on monitor mode 56 Bugfixes in lldp, lspping, dccp, ESP, NFS printers 57 Cleanup unused files and various cruft 58 59 Mon. September 10, 2007. ken (a] xelerance.com. Summary for 3.9.8 tcpdump release 60 Rework ARP printer 61 Rework OSPFv3 printer 62 Add support for Frame-Relay ARP 63 Decode DHCP Option 121 (RFC 3442 Classless Static Route) 64 Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121 65 TLV: Add support for Juniper .pcap extensions 66 Print EGP header in new-world-order style 67 Converted print-isakmp.c to NETDISSECT 68 Moved AF specific stuff into af.h 69 Test subsystem now table driven, and saves outputs and diffs to one place 70 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 71 libpcap files on an OS other than where the file was generated 72 73 74 Wed. July 23, 2007. mcr (a] xelerance.com. Summary for 3.9.7 libpcap release 75 76 NFS: Print unsigned values as such. 77 RX: parse safely. 78 BGP: fixes for IPv6-less builds. 79 801.1ag: use standard codepoint. 80 use /dev/bpf on systems with such a device. 81 802.11: print QoS data, avoid dissect of no-data frame, ignore padding. 82 smb: make sure that we haven't gone past the end of the captured data. 83 smb: squelch an uninitialized complaint from coverity. 84 NFS: from NetBSD; don't interpret the reply as a possible NFS reply 85 if it got MSG_DENIED. 86 BGP: don't print TLV values that didn't fit, from www.digit-labs.org. 87 revised INSTALL.txt about libpcap dependancy. 88 89 Wed. April 25, 2007. ken (a] xelerance.com. Summary for 3.9.6 tcpdump release 90 Update man page to reflect changes to libpcap 91 Changes to both TCP and IP Printer Output 92 Fix a potential buffer overflow in the 802.11 printer 93 Print basic info about a few more Cisco LAN protocols. 94 mDNS cleanup 95 ICMP MPLS rework of the extension code 96 bugfix: use the correct codepoint for the OSPF simple text auth token 97 entry, and use safeputs to print the password. 98 Add support in pflog for additional values 99 Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects 100 Add support for the Message-id NACK c-type. 101 Add support for 802.3ah loopback ctrl msg 102 Add support for Multiple-STP as per 802.1s 103 Add support for rapid-SPT as per 802.1w 104 Add support for CFM Link-trace msg, Link-trace-Reply msg, 105 Sender-ID tlv, private tlv, port, interface status 106 Add support for unidirectional link detection as per 107 http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt 108 Add support for the olsr protocol as per RFC 3626 plus the LQ 109 extensions from olsr.org 110 Add support for variable-length checksum in DCCP, as per section 9 of 111 RFC 4340. 112 Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree 113 Add support for Multiple-STP as per 802.1s 114 Add support for the cisco propriatry 'dynamic trunking protocol' 115 Add support for the cisco proprietary VTP protocol 116 Update dhcp6 options table as per IETF standardization activities 117 118 119 Tue. September 19, 2006. ken (a] xelerance.com. Summary for 3.9.5 tcpdump release 120 121 Fix compiling on AIX (, at end of ENUM) 122 Updated list of DNS RR typecodes 123 Use local Ethernet defs on WIN32 124 Add support for Frame-Relay ARP 125 Fixes for compiling under MSVC++ 126 Add support for parsing Juniper .pcap files 127 Add support for FRF.16 Multilink Frame-Relay (DLT_MFR) 128 Rework the OSPFv3 printer 129 Fix printing for 4.4BSD/NetBSD NFS Filehandles 130 Add support for Cisco style NLPID encapsulation 131 Add cisco prop. eigrp related, extended communities 132 Add support for BGP signaled VPLS 133 Cleanup the bootp printer 134 Add support for PPP over Frame-Relay 135 Add some bounds checking to the IP options code, and clean up 136 the options output a bit. 137 Add additional modp groups to ISAKMP printer 138 Add support for Address-Withdraw and Label-Withdraw Msgs 139 Add support for the BFD Discriminator TLV 140 Fixes for 64bit compiling 141 Add support for PIMv2 checksum verification 142 Add support for further dissection of the IPCP Compression Option 143 Add support for Cisco's proposed VQP protocol 144 Add basic support for keyed authentication TCP option 145 Lots of minor cosmetic changes to output printers 146 147 148 Mon. September 19, 2005. ken (a] xelerance.com. Summary for 3.9.4 tcpdump release 149 Decoder support for more Juniper link-layer types 150 Fix a potential buffer overflow (although it can't occur in 151 practice). 152 Fix the handling of unknown management frame types in the 802.11 153 printer. 154 Add FRF.16 support, fix various Frame Relay bugs. 155 Add support for RSVP integrity objects, update fast-reroute 156 object printer to latest spec. 157 Clean up documentation of vlan filter expression, document mpls 158 filter expression. 159 Document new pppoed and pppoes filter expressions. 160 Update diffserver-TE codepoints as per RFC 4124. 161 Spelling fixes in ICMPv6. 162 Don't require any fields other than flags to be present in IS-IS 163 restart signaling TLVs, and only print the system ID in 164 those TLVs as system IDs, not as node IDs. 165 Support for DCCP. 166 167 Tue. July 5, 2005. ken (a] xelerance.com. Summary for 3.9.3 tcpdump release 168 169 Option to chroot() when dropping privs 170 Fixes for compiling on nearly every platform, 171 including improved 64bit support 172 Many new testcases 173 Support for sending packets 174 Many compliation fixes on most platforms 175 Fixes for recent version of GCC to eliminate warnings 176 Improved Unicode support 177 178 Decoders & DLT Changes, Updates and New: 179 AES ESP support 180 Juniper ATM, FRF.15, FRF.16, PPPoE, 181 ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC 182 GGSN,ES,MONITOR,SERVICES 183 L2VPN 184 Axent Raptor/Symantec Firewall 185 TCP-MD5 (RFC 2385) 186 ESP-in-UDP (RFC 3948) 187 ATM OAM 188 LMP, LMP Service Discovery 189 IP over FC 190 IP over IEEE 1394 191 BACnet MS/TP 192 SS7 193 LDP over TCP 194 LACP, MARKER as per 802.3ad 195 PGM (RFC 3208) 196 LSP-PING 197 G.7041/Y.1303 Generic Framing Procedure 198 EIGRP-IP, EIGRP-IPX 199 ICMP6 200 Radio - via radiotap 201 DHCPv6 202 HDLC over PPP 203 204 Tue. March 30, 2004. mcr (a] sandelman.ottawa.on.ca. Summary for 3.8.3 release 205 206 No changes from 3.8.2. Version bumped only to maintain consistency 207 with libpcap 0.8.3. 208 209 Mon. March 29, 2004. mcr (a] sandelman.ottawa.on.ca. Summary for 3.8.2 release 210 211 Fixes for print-isakmp.c CVE: CAN-2004-0183, CAN-2004-0184 212 http://www.rapid7.com/advisories/R7-0017.html 213 IP-over-IEEE1394 printing. 214 some MINGW32 changes. 215 updates for autoconf 2.5 216 fixes for print-aodv.c - check for too short packets 217 formatting changes to print-ascii for hex output. 218 check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c, 219 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c, 220 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c, 221 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c 222 print-ether.c - better handling of unknown types. 223 print-isoclns.c - additional decoding of types. 224 print-llc.c - strings for LLC names added. 225 print-pfloc.c - various enhancements 226 print-radius.c - better decoding to strings. 227 228 Wed. November 12, 2003. mcr (a] sandelman.ottawa.on.ca. Summary for 3.8 release 229 230 changed syntax of -E argument so that multiple SAs can be decrypted 231 fixes for Digital Unix headers and Documentation 232 __attribute__ fixes 233 CDP changes from Terry Kennedy <terry (a] tmk.com>. 234 IPv6 mobility updates from Kazushi Sugyo <sugyo (a] pb.jp.nec.com> 235 Fixes for ASN.1 decoder for 2.100.3 forms. 236 Added a count of packets received and processed to clarify numbers. 237 Incorporated WinDUMP patches for Win32 builds. 238 PPPoE payload length headers. 239 Fixes for HP C compiler builds. 240 Use new pcap_breakloop() and pcap_findalldevs() if we can. 241 BGP output split into multiple lines. 242 Fixes to 802.11 decoding. 243 Fixes to PIM decoder. 244 SuperH is a CPU that can't handle unaligned access. Many fixes for 245 unaligned access work. 246 Fixes to Frame-Relay decoder for Q.933/922 frames. 247 Clarified when Solaris can do captures as non-root. 248 Added tests/ subdir for examples/regression tests. 249 New -U flag. -flush stdout after every packet 250 New -A flag -print ascii only 251 support for decoding IS-IS inside Cisco HDLC Frames 252 more verbosity for tftp decoder 253 mDNS decoder 254 new BFD decoder 255 cross compilation patches 256 RFC 3561 AODV support. 257 UDP/TCP pseudo-checksum properly for source-route options. 258 sanitized all files to modified BSD license 259 Add support for RFC 2625 IP-over-Fibre Channel. 260 fixes for DECnet support. 261 Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI. 262 RFC 2684 encapsulation of BPDUs. 263 264 Tuesday, February 25, 2003. fenner (a] research.att.com. 3.7.2 release 265 266 Fixed infinite loop when parsing malformed isakmp packets. 267 (reported by iDefense; already fixed in CVS) 268 Fixed infinite loop when parsing malformed BGP packets. 269 Fixed buffer overflow with certain malformed NFS packets. 270 Pretty-print unprintable network names in 802.11 printer. 271 Handle truncated nbp (appletalk) packets. 272 Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt 273 Print IP protocol name even if we don't have a printer for it. 274 Print IP protocol name or number for fragments. 275 Print the whole MPLS label stack, not just the top label. 276 Print request header and file handle for NFS v3 FSINFO and PATHCONF 277 requests. 278 Fix NFS packet truncation checks. 279 Handle "old" DR-Priority and Bidir-Capable PIM HELLO options. 280 Handle unknown RADIUS attributes properly. 281 Fix an ASN.1 parsing error that would cause e.g. the OID 282 2.100.3 to be misrepresented as 4.20.3 . 283 284 Monday, January 21, 2002. mcr (a] sandelman.ottawa.on.ca. Summary for 3.7 release 285 see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log. 286 keyword "ipx" added. 287 Better OSI/802.2 support on Linux. 288 IEEE 802.11 support, from clenahan (a] fortresstech.com, achirica (a] ttd.net. 289 LLC SAP support for FDDI/token ring/RFC-1483 style ATM 290 BXXP protocol was replaced by the BEEP protocol; 291 improvements to SNAP demux. 292 Changes to "any" interface documentation. 293 Documentation on pcap_stats() counters. 294 Fix a memory leak found by Miklos Szeredi - pcap_ether_aton(). 295 Added MPLS encapsulation decoding per RFC3032. 296 DNS dissector handles TKEY, TSIG and IXFR. 297 adaptive SLIP interface patch from Igor Khristophorov <igor (a] atdot.org> 298 SMB printing has much improved bounds checks 299 OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging 300 Zephyr support, from Nickolai Zeldovich <kolya (a] MIT.EDU>. 301 Solaris - devices with digits in them. Stefan Hudson <hudson (a] mbay.net> 302 IPX socket 0x85be is for Cisco EIGRP over IPX. 303 Improvements to fragmented ESP handling. 304 SCTP support from Armando L. Caro Jr. <acaro (a] mail.eecis.udel.edu> 305 Linux ARPHDR_ATM support fixed. 306 Added a "netbeui" keyword, which selects NetBEUI packets. 307 IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option. 308 Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus (a] task.com.br>. 309 Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm" 310 Better Linux libc5 compat. 311 BIND9 lwres dissector added. 312 MIPS and SPARC get strict alignment macros (affects print-bgp.c) 313 Apple LocalTalk LINKTYPE_ reserved. 314 New time stamp formats documented. 315 DHCP6 updated to draft-22.txt spec. 316 ICMP types/codes now accept symbolic names. 317 Add SIGINFO handler from LBL 318 encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer (a] mond.at>. 319 now we are -Wstrict-prototype clean. 320 NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin (a] netbsd.org>. 321 PPPoE dissector cleaned up. 322 Support for LocalTalk hardware, from Uns Lider <unslider (a] miranda.org>. 323 In dissector, now the caller prints the IP addresses rather than proto. 324 cjclark (a] alum.mit.edu: print the IP proto for non-initial fragments. 325 LLC frames with a DSAP and LSAP of 0xe0 are IPX frames. 326 Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX. 327 captures on the "any" device won't be done in promiscuous mode 328 Token Ring support on DLPI - Onno van der Linden <onno (a] simplex.nl> 329 ARCNet support, from NetBSD. 330 HSRP dissector, from Julian Cowley <julian (a] lava.net>. 331 Handle (GRE-encapsulated) PPTP 332 added -C option to rotate save file every optarg * 1,000,000 bytes. 333 support for "vrrp" name - NetBSD, by Klaus Klein <kleink (a] netbsd.org>. 334 PPTP support, from Motonori Shindo <mshindo (a] mshindo.net>. 335 IS-IS over PPP support, from Hannes Gredler <hannes (a] juniper.net>. 336 CNFP support for IPv6,format. Harry Raaymakers <harryr (a] connect.com.au>. 337 ESP printing updated to RFC2406. 338 HP-UX can now handle large number of PPAs. 339 MSDP printer added. 340 L2TP dissector improvements from Motonori Shindo. 341 342 Tuesday January 9, 2001. mcr (a] sandelman.ottawa.on.ca. Summary for 3.6 release 343 Cleaned up documentation. 344 Promisc mode fixes for Linux 345 IPsec changes/cleanups. 346 Alignment fixes for picky architectures 347 348 Removed dependency on native headers for packet dissectors. 349 Removed Linux specific headers that were shipped 350 351 libpcap changes provide for exchanging capture files between 352 systems. Save files now have well known PACKET_ values instead of 353 depending upon system dependant mappings of DLT_* types. 354 355 Support for computing/checking IP and UDP/TCP checksums. 356 357 Updated autoconf stock files. 358 359 IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6, 360 361 Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp, 362 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk 363 364 Added filtering support for: VLANs, ESIS, ISIS 365 366 Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP, 367 L2TP, PPPoE 368 369 HP-UX 11.0 -- find the right dlpi device. 370 Solaris 8 - IPv6 works 371 Linux - Added support for an "any" device to capture on all interfaces 372 373 Security fixes: buffer overrun audit done. Strcpy replaced with 374 strlcpy, sprintf replaced with snprintf. 375 Look for lex problems, and warn about them. 376 377 378 v3.5 Fri Jan 28 18:00:00 PST 2000 379 380 Bill Fenner <fenner (a] research.att.com> 381 - switch to config.h for autoconf 382 - unify RCSID strings 383 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser 384 - Really fix the RIP printer 385 - Fix MAC address -> name translation. 386 - some -Wall -Wformat fixes 387 - update makemib to parse much of SMIv2 388 - Print TCP sequence # with -vv even if you normally wouldn't 389 - Print as much of IP/TCP/UDP headers as possible even if truncated. 390 391 itojun (a] iijlab.net 392 - -X will make a ascii dump. from netbsd. 393 - telnet command sequence decoder (ff xx xx). from netbsd. 394 - print-bgp.c: improve options printing. ugly code exists for 395 unaligned option parsing (need some fix). 396 - const poisoning in SMB decoder. 397 - -Wall -Werror clean checks. 398 - bring in KAME IPv6/IPsec decoding code. 399 400 Assar Westerlund <assar (a] sics.se> 401 - SNMPv2 and SNMPv3 printer 402 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode 403 SNMP packets. 404 - Incorporate NFS parsing code from NetBSD. Adds support for nfsv3. 405 - portability fixes 406 - permit building in different directories. 407 408 Ken Hornstein <kenh (a] cmf.nrl.navy.mil> 409 - bring in code at 410 /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing 411 AFS3 packets 412 413 Andrew Tridgell <tridge (a] linuxcare.com> 414 - SMB printing code 415 416 Love <lha (a] stacken.kth.se> 417 - print-rx.c: add code for printing MakeDir and StoreStatus. Also 418 change date format to the right one. 419 420 Michael C. Richardson <mcr (a] sandelman.ottawa.on.ca> 421 - Created tcpdump.org repository 422 423 v3.4 Sat Jul 25 12:40:55 PDT 1998 424 425 - Hardwire Linux slip support since it's too hard to detect. 426 427 - Redo configuration of "network" libraries (-lsocket and -lnsl) to 428 deal with IRIX. Thanks to John Hawkinson (jhawk (a] mit.edu) 429 430 - Added -a which tries to translate network and broadcast addresses to 431 names. Suggested by Rob van Nieuwkerk (robn (a] verdi.et.tudelft.nl) 432 433 - Added a configure option to disable gcc. 434 435 - Added a "raw" packet printer. 436 437 - Not having an interface address is no longer fatal. Requested by John 438 Hawkinson. 439 440 - Rework signal setup to accommodate Linux. 441 442 - OSPF truncation check fix. Also display the type of OSPF packets 443 using MD5 authentication. Thanks to Brian Wellington 444 (bwelling (a] tis.com) 445 446 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra 447 Peisach (epeisach (a] mit.edu) 448 449 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka 450 (plonka (a] mfa.com) 451 452 - Specify full install target as a way of detecting if install 453 directory does not exist. Thanks to Dave Plonka. 454 455 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie 456 (paul (a] vix.com) 457 458 - Fix off-by-one bug when testing size of ethernet packets. Thanks to 459 Marty Leisner (leisner (a] sdsp.mc.xerox.com) 460 461 - Add a local autoconf macro to check for routines in libraries; the 462 autoconf version is broken (it only puts the library name in the 463 cache variable name). Thanks to John Hawkinson. 464 465 - Add a local autoconf macro to check for types; the autoconf version 466 is broken (it uses grep instead of actually compiling a code fragment). 467 468 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header 469 formats. 470 471 - Extend OSF ip header workaround to versions 1 and 2. 472 473 - Fix some signed problems in the nfs printer. As reported by David 474 Sacerdote (davids (a] silence.secnet.com) 475 476 - Detect group wheel and use it as the default since BSD/OS' install 477 can't hack numeric groups. Reported by David Sacerdote. 478 479 - AIX needs special loader options. Thanks to Jonathan I. Kamens 480 (jik (a] cam.ov.com) 481 482 - Fixed the nfs printer to print port numbers in decimal. Thanks to 483 Kent Vander Velden (graphix (a] iastate.edu) 484 485 - Find installed libpcap in /usr/local/lib when not using gcc. 486 487 - Disallow network masks with non-network bits set. 488 489 - Attempt to detect "egcs" versions of gcc. 490 491 - Add missing closing double quotes when displaying bootp strings. 492 Reported by Viet-Trung Luu (vluu (a] picard.math.uwaterloo.ca) 493 494 v3.3 Sat Nov 30 20:56:27 PST 1996 495 496 - Added Linux support. 497 498 - GRE encapsulated packet printer thanks to John Hawkinson 499 (jhawk (a] mit.edu) 500 501 - Rewrite gmt2local() to avoid problematic os dependencies. 502 503 - Suppress nfs truncation message on errors. 504 505 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro. 506 Reported by Joachim Ott (ott (a] ardala.han.de) 507 508 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too. 509 510 - Print arp hardware type in host order. Thanks to Onno van der Linden 511 (onno (a] simplex.nl) 512 513 - Avoid solaris compiler warnings. Thanks to Bruce Barnett 514 (barnett (a] grymoire.crd.ge.com) 515 516 - Fix rip printer to not print one more route than is actually in the 517 packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier (a] imag.fr) and 518 Bill Fenner (fenner (a] parc.xerox.com) 519 520 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems. 521 522 - Fix dvmrp printer truncation checks and add a dvmrp probe printer. 523 Thanks to Danny J. Mitzel (mitzel (a] ipsilon.com) 524 525 - Rewrite ospf printer to improve truncation checks. 526 527 - Don't parse tcp options past the EOL. As noted by David Sacerdote 528 (davids (a] secnet.com). Also, check tcp options to make sure they ar 529 actually in the tcp header (in addition to the normal truncation 530 checks). Fix the SACK code to print the N blocks (instead of the 531 first block N times). 532 533 - Don't say really small UDP packets are truncated just because they 534 aren't big enough to be a RPC. As noted by David Sacerdote. 535 536 v3.2.1 Sun Jul 14 03:02:26 PDT 1996 537 538 - Added rfc1716 icmp codes as suggested by Martin Fredriksson 539 (martin (a] msp.se) 540 541 - Print mtu for icmp unreach need frag packets. Thanks to John 542 Hawkinson (jhawk (a] mit.edu) 543 544 - Decode icmp router discovery messages. Thanks to Jeffrey Honig 545 (jch (a] bsdi.com) 546 547 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida 548 (kushida (a] trl.ibm.co.jp) 549 550 - Check igmp checksum if possible. Thanks to John Hawkinson. 551 552 - Made changes for SINIX. Thanks to Andrej Borsenkow 553 (borsenkow.msk (a] sni.de) 554 555 - Use autoconf's idea of the top level directory in install targets. 556 Thanks to John Hawkinson. 557 558 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey 559 Mogul (mogul (a] pa.dec.com) 560 561 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop. 562 Thanks to John Hawkinson. 563 564 - Added some more packet truncation checks. 565 566 - On systems that have it, use sigset() instead of signal() since 567 signal() has different semantics on these systems. 568 569 - Fixed some more alignment problems on the alpha. 570 571 - Add code to massage unprintable characters in the domain and ipx 572 printers. Thanks to John Hawkinson. 573 574 - Added explicit netmask support. Thanks to Steve Nuchia 575 (steve (a] research.oknet.com) 576 577 - Add "sca" keyword (for DEC cluster services) as suggested by Terry 578 Kennedy (terry (a] spcvxa.spc.edu) 579 580 - Add "atalk" keyword as suggested by John Hawkinson. 581 582 - Added an igrp printer. Thanks to Francis Dupont 583 (francis.dupont (a] inria.fr) 584 585 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry 586 Kennedy (terry (a] spcvxa.spc.edu) 587 588 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin 589 (pascal.hennequin (a] hugo.int-evry.fr) 590 591 - Added some ETHERTYPEs missing on some systems. 592 593 - Added truncated packet macros and various checks. 594 595 - Fixed endian problems with the DECnet printer. 596 597 - Use $CC when checking gcc version. Thanks to Carl Lindberg 598 (carl_lindberg (a] blacksmith.com) 599 600 - Fixes for AIX (although this system is not yet supported). Thanks to 601 John Hawkinson. 602 603 - Fix bugs in the autoconf misaligned accesses code fragment. 604 605 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to 606 Pavlin Ivanov Radoslavov (pavlin (a] cs.titech.ac.jp) 607 608 v3.2 Sun Jun 23 02:28:10 PDT 1996 609 610 - Print new icmp unreachable codes as suggested by Martin Fredriksson 611 (martin (a] msp.se). Also print code value when unknown for icmp redirect 612 and time exceeded. 613 614 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson. 615 616 - Define "new" domain record types if not found in arpa/nameserv.h. 617 Resulted from a suggestion from John Hawkinson (jhawk (a] mit.edu). Also 618 fixed an endian bug when printing mx record and added some new record 619 types. 620 621 - Added RIP V2 support. Thanks to Jeffrey Honig (jch (a] bsdi.com) 622 623 - Added T/TCP options printing. As suggested by Richard Stevens 624 (rstevens (a] noao.edu) 625 626 - Use autoconf to detect architectures that can't handle misaligned 627 accesses. 628 629 v3.1 Thu Jun 13 20:59:32 PDT 1996 630 631 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd 632 and bind (as suggested by Charles Hannum). 633 634 - Port to GNU autoconf. 635 636 - Add support for printing DVMRP and PIM traffic thanks to 637 Havard Eidnes (Havard.Eidnes (a] runit.sintef.no). 638 639 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian 640 define being referenced. Reported by Terry Kennedy. 641 642 - Minor fixes to the man page thanks to Mark Andrews. 643 644 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah 645 (bmah (a] cs.berkeley.edu). 646 647 - Added support for new dns types, thanks to Rainer Orth. 648 649 - Fixed tftp_print() to print the block number for ACKs. 650 651 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater 652 (cslater (a] imatek.com). 653 654 - Check return status from malloc/calloc/etc. 655 656 - Check return status from pcap_loop() so we can print an error and 657 exit with a bad status if there were problems. 658 659 - Bail if ip option length is <= 0. Resulted from a bug report from 660 Darren Reed (darrenr (a] vitruvius.arbld.unimelb.edu.au). 661 662 - Print out a little more information for sun rpc packets. 663 664 - Add suport for Kerberos 4 thanks to John Hawkinson (jhawk (a] mit.edu). 665 666 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were 667 wrong on little endian machines). 668 669 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford 670 (crawdad (a] fnal.gov). 671 672 - Fix ntp_print() to not print garbage when the stratum is 673 "unspecified." Thanks to Deus Ex Machina (root (a] belle.bork.com). 674 675 - Rewrote tcp options printer code to check for truncation. Added 676 selective acknowledgment case. 677 678 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig 679 (jch (a] bsdi.com) 680 681 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one 682 octet for the sa_family member. Thanks to Yoshitaka Tokugawa 683 (toku (a] dit.co.jp) 684 685 - Don't checksum ip header if we don't have all of it. Thanks to John 686 Hawkinson (jhawk (a] mit.edu). 687 688 - Print out hostnames if possible in egp printer. Thanks to Jeffrey 689 Honig (jhc (a] bsdi.com) 690 691 692 v3.1a1 Wed May 3 19:21:11 PDT 1995 693 694 - Include time.h when SVR4 is defined to avoid problems under Solaris 695 2.3. 696 697 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved 698 strings, not the local buffer. Thanks to Stefan Petri 699 (petri (a] ibr.cs.tu-bs.de). 700 701 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning 702 that the selected value was not used. Thanks to Pascal Hennequin 703 (Pascal.Hennequin (a] hugo.int-evry.fr). 704 705 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin. 706 707 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry (a] spcvxa.spc.edu). 708 709 v3.0.3 Sun Oct 1 18:35:00 GMT 1995 710 711 - Although there never was a 3.0.3 release, the linux boys cleverly 712 "released" one in late 1995. 713 714 v3.0.2 Thu Apr 20 21:28:16 PDT 1995 715 716 - Change configuration to not use gcc v2 flags with gcc v1. 717 718 - Redo gmt2local() so that it works under BSDI (which seems to return 719 an empty timezone struct from gettimeofday()). Based on report from 720 Terry Kennedy (terry (a] spcvxa.spc.edu). 721 722 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based 723 on report from Mark Andrews (mandrews (a] alias.com). 724 725 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer 726 Orth (ro (a] techfak.uni-bielefeld.de). 727 728 - Fixed printout of connection id for uncompressed tcp slip packets. 729 Resulted from a bug report from Richard Stevens (rstevens (a] noao.edu). 730 731 - Hack around deficiency in Ultrix's make. 732 733 - Add ETHERTYPE_TRAIL define which is missing from irix5. 734 735 v3.0.1 Wed Aug 31 22:42:26 PDT 1994 736 737 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4. 738 739 v3.0 Mon Jun 20 19:23:27 PDT 1994 740 741 - Added support for printing tcp option timestamps thanks to 742 Mark Andrews (mandrews (a] alias.com). 743 744 - Reorganize protocol dumpers to take const pointers to packets so they 745 never change the contents (i.e., they used to do endian conversions 746 in place). Previously, whenever more than one pass was taken over 747 the packet, the packet contents would be dumped incorrectly (i.e., 748 the output form -x would be wrong on little endian machines because 749 the protocol dumpers would modify the data). Thanks to Charles Hannum 750 (mycroft (a] gnu.ai.mit.edu) for reporting this problem. 751 752 - Added support for decnet protocol dumping thanks to Jeff Mogul 753 (mogul (a] pa.dec.com). 754 755 - Fix bug that caused length of packet to be incorrectly printed 756 (off by ether header size) for unknown ethernet types thanks 757 to Greg Miller (gmiller (a] kayak.mitre.org). 758 759 - Added support for IPX protocol dumping thanks to Brad Parker 760 (brad (a] fcr.com). 761 762 - Added check to verify IP header checksum under -v thanks to 763 Brad Parker (brad (a] fcr.com). 764 765 - Move packet capture code to new libpcap library (which is 766 packaged separately). 767 768 - Prototype everything and assume an ansi compiler. 769 770 - print-arp.c: Print hardware ethernet addresses if they're not 771 what we expect. 772 773 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags. 774 Many helpful suggestions from Gordon Ross (gwr (a] jericho.mc.com). 775 776 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul 777 (mogul (a] pa.dec.com). 778 779 - print-icmp.c: Byte swap netmask before printing. Thanks to 780 Richard Stevens (rstevens (a] noao.edu). Print icmp type when unknown. 781 782 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets. 783 By default, only the inner packet is dumped, appended with the token 784 "(encap)". Under -v, both the inner and output packets are dumped 785 (on the same line). Note that the filter applies to the original packet, 786 not the encapsulated packet. So if you run tcpdump on a net with an 787 IP Multicast tunnel, you cannot filter out the datagrams using the 788 conventional syntax. (You can filter away all the ip-in-ip traffic 789 with "not ip proto 4".) 790 791 - print-nfs.c: Keep pending rpc's in circular table. Add generic 792 nfs header and remove os dependences. Thanks to Jeffrey Mogul. 793 794 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul. 795 796 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc" 797 (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords 798 Add && and || operators 799 800 v2.2.1 Tue Jun 6 17:57:22 PDT 1992 801 802 - Fix bug with -c flag. 803 804 v2.2 Fri May 22 17:19:41 PDT 1992 805 806 - savefile.c: Remove hack that shouldn't have been exported. Add 807 truncate checks. 808 809 - Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0' 810 matches non-echo/reply ICMP packets. 811 812 - Many improvements to filter code optimizer. 813 814 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be 815 so that protocol qualifications are allowed. For example, "ip broadcast" 816 and "ether multicast" are valid filters. 817 818 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo'). 819 Jeffrey Honig (jch (a] MITCHELL.CIT.CORNELL.EDU) contributed the kernel 820 patches to netinet/if_loop.c. 821 822 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS. 823 Contact Jeffrey Honig (jch (a] MITCHELL.CIT.CORNELL.EDU) for the diffs. 824 825 - Added EGP and OSPF printers, thanks to Jeffrey Honig. 826 827 v2.1 Tue Jan 28 11:00:14 PST 1992 828 829 - Internal release (never publically exported). 830 831 v2.0.1 Sun Jan 26 21:10:10 PDT 832 833 - Various byte ordering fixes. 834 835 - Add truncation checks. 836 837 - inet.c: Support BSD style SIOCGIFCONF. 838 839 - nametoaddr.c: Handle multi addresses for single host. 840 841 - optimize.c: Rewritten. 842 843 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous 844 for broadcast nets. 845 846 - print-atal.c: Fix an alignment bug (thanks to 847 stanonik (a] nprdc.navy.mil) Add missing printf() argument. 848 849 - print-bootp.c: First attempt at decoding the vendor buffer. 850 851 - print-domain.c: Fix truncation checks. 852 853 - print-icmp.c: Calculate length of packets from the ip header. 854 855 - print-ip.c: Print frag id in decimal (so it's easier to match up 856 with non-frags). Add support for ospf, egp and igmp. 857 858 - print-nfs.c: Lots of changes. 859 860 - print-ntp.c: Make some verbose output depend on -v. 861 862 - print-snmp.c: New version from John LoVerso. 863 864 - print-tcp.c: Print rfc1072 tcp options. 865 866 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits 867 (microseconds) worth of precision. Fix uid bugs. 868 869 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL). 870 With this option, you can create an architecture independent binary 871 trace file in real time, without the overhead of the packet printer. 872 At a later time, the packets can be filtered (again) and printed. 873 874 - BSD is supported. You must have BPF in your kernel. 875 Since the filtering is now done in the kernel, fewer packets are 876 dropped. In fact, with BPF and the packet dumper option, a measly 877 Sun 3/50 can keep up with a busy network. 878 879 - Compressed SLIP packets can now be dumped, provided you use our 880 SLIP software and BPF. These packets are dumped as any other IP 881 packet; the compressed headers are dumped with the '-e' option. 882 883 - Machines with little-endian byte ordering are supported (thanks to 884 Jeff Mogul). 885 886 - Ultrix 4.0 is supported (also thanks to Jeff Mogul). 887 888 - IBM RT and Stanford Enetfilter support has been added by 889 Rayan Zachariassen <rayan (a] canet.ca>. Tcpdump has been tested under 890 both the vanilla Enetfilter interface, and the extended interface 891 (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter. 892 893 - TFTP packets are now printed (requests only). 894 895 - BOOTP packets are now printed. 896 897 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics). 898 899 - Sparc architectures, including the Sparcstation-1, are now 900 supported thanks to Steve McCanne and Craig Leres. 901 902 - SunOS 4 is now supported thanks to Micky Liu of Columbia 903 University (micky (a] cunixc.cc.columbia.edu). 904 905 - IP options are now printed. 906 907 - RIP packets are now printed. 908 909 - There's a -v flag that prints out more information than the 910 default (e.g., it will enable printing of IP ttl, tos and id) 911 and -q flag that prints out less (e.g., it will disable 912 interpretation of AppleTalk-in-UDP). 913 914 - The grammar has undergone substantial changes (if you have an 915 earlier version of tcpdump, you should re-read the manual 916 entry). 917 918 The most useful change is the addition of an expression 919 syntax that lets you filter on arbitrary fields or values in the 920 packet. E.g., "ip[0] > 0x45" would print only packets with IP 921 options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN 922 packets. 923 924 The most painful change is that concatenation no longer means 925 "and" -- e.g., you have to say "host foo and port bar" instead 926 of "host foo port bar". The up side to this down is that 927 repeated qualifiers can be omitted, making most filter 928 expressions shorter. E.g., you can now say "ip host foo and 929 (bar or baz)" to look at ip traffic between hosts foo and bar or 930 between hosts foo and baz. [The old way of saying this was "ip 931 host foo and (ip host bar or ip host baz)".] 932 933 v2.0 Sun Jan 13 12:20:40 PST 1991 934 935 - Initial public release. 936
Indexes created Mon Apr 27 00:23:16 UTC 2026